start up scan results

MpsSvc Service is not running. Checking service configuration: Checking Start type: Attention! Unable to retrieve start type of MpsSvc. The value does not exist. Checking ImagePath: Attention! Unable to retrieve ImagePath of MpsSvc. The value does not exist. Unable to retrieve ServiceDll of MpsSvc. The value does not exist.

bfe Service is not running. Checking service configuration:
Checking Start type: Attention! Unable to open bfe registry key. The service key does not exist.
Checking ImagePath: Attention! Unable to open bfe registry key. The service key does not exist.
Checking ServiceDll: Attention! Unable to open bfe registry key. The service key does not exist.

You have two registry entries missing which is why the service is not starting

[*]Run OTL
[*]Select All Users
[*]Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%*.exe
/md5start
MpsSvc.*
/md5stop
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\bfe /s
CREATERESTOREPOINT

[*]Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Post both logs

Here’s the OTL report. Still working on True Indian’s stuff.

Ummmmm… Can’t find it in the services window. Looked in standard and extended. But I did learn to quote. :smiley:

You won’t find it as the malware has deleted that key

I have set the registry keys for you - but as the forum will not allow zip files I have uploaded them to mediafire

Download the BFE.zip file from here to your desktop http://www.mediafire.com/?k19patek22pljan
Extract both reg files
bfe.reg
MpsSvc.reg

Right click the reg files one at a time and select merge, accept the warnings

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5577 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5577 IE - HKU\S-1-5-21-2195380765-1075800627-1758483567-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local; IE - HKU\S-1-5-21-2195380765-1075800627-1758483567-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5577 O3 - HKU\S-1-5-21-2195380765-1075800627-1758483567-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3 - HKU\S-1-5-21-2195380765-1075800627-1758483567-1003\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3 - HKU\S-1-5-21-2195380765-1075800627-1758483567-1004\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. [2011/12/25 20:01:32 | 000,000,000 | ---D | C] -- C:\Windows\system64 [2011/12/25 20:03:36 | 000,012,848 | -HS- | M] () -- C:\Users\Melissa\AppData\Local\lx50kqrc6od1323iw7426qx7vp2mt3y3 [2011/12/25 20:03:36 | 000,012,848 | -HS- | M] () -- C:\ProgramData\lx50kqrc6od1323iw7426qx7vp2mt3y3 [2011/12/11 17:30:29 | 000,010,188 | -HS- | M] () -- C:\Users\Melissa\AppData\Local\5o42hc3l58u034 [2011/12/11 17:30:29 | 000,010,188 | -HS- | M] () -- C:\ProgramData\5o42hc3l58u034 [2011/12/25 20:01:17 | 000,012,848 | -HS- | C] () -- C:\Users\Melissa\AppData\Local\lx50kqrc6od1323iw7426qx7vp2mt3y3 [2011/12/25 20:01:17 | 000,012,848 | -HS- | C] () -- C:\ProgramData\lx50kqrc6od1323iw7426qx7vp2mt3y3 [2011/12/11 15:19:48 | 000,010,188 | -HS- | C] () -- C:\Users\Melissa\AppData\Local\5o42hc3l58u034 [2011/12/11 15:19:48 | 000,010,188 | -HS- | C] () -- C:\ProgramData\5o42hc3l58u034

:Files
ipconfig /flushdns /c
netsh int ip reset c:\resetlog.txt /c
netsh int ip reset resetlog.txt /c

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]


[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

:o EEEEEEEEEEE Panic!! Run around! Scream! PANIC!! PANIC!! :o

Okay I’m done now. So, here I am on my Mom’s computer to report. I did what you told me to do, EssexBoy, and my computer won’t start now. And it tells me that there are no system restore points! I did the merge thing and it said it worked fine. Then I ran OTL with the fix you told me to run. It gave me an error: Cannot create file C:\Windows\System32\drivers\otc\Hosts. The only option was to click “ok”. Later OTL got to the “resetting hosts” part of its run and stayed there. It had been running for about an hour when I went to bed. When my husband got up this morning the computer was at a black screen, but appeared to be on. (the lights on the DVD control bar were on) He tried to push a couple of buttons to wake up the screen (thinking that the screen had just gone to sleep), but nothing happened. He then did a hard power off by holding the power button down for 5 seconds. The boot failed and went to Startup Repair. Which gave him this error:

Problem event name: Startup Repair offline
Problem signature 1: 6.1.7600.16385
" " 2: 6.1.7600.16385
" " 3: unknown
" " 4: 21200734
" " 5: Autofailover
" " 6: 2
" " 7: Corruptfile
OS version 6.1.7600.2.0.0.256.1
Locale ID 1033

Under “Problem Details” it said:
boot critical file C:\Windows\system32\ntoskrnl.exe is corrupt.

PLEASE tell me this is fixable! PANIC! :cry:

Well this is a pretty crucial file and if it were truly corrupt you probably couldn’t boot, the symptoms you appear to be experiencing.
http://www.processlibrary.com/directory/files/ntoskrnl/22115/

So for the time being until you get clarification from essexboy, I wouldn’t try anything else just in case. If it is corrupt it will need to be replaced with a good copy probably from the recovery console; not sure if OTL can find a good copy and replace it, but essexboy should know.

So yes, hopefully it is fixable.

OK not sure how that happened as we went nowhere near it

Ok from my site download the windows 7 ntoskrnl file to a USB https://skydrive.live.com/?cid=32D8666F4048075B&id=32D8666F4048075B!117&sc=documents

Then reboot the the computer then press and hold the F8 key
When you see the menu select safe mode with networking
Does the computer go to safe mode ?

If so then reboot to normal mode does that now work

If not then from the safe mode menu select Command prompt
Type the following bolded text and press enter :

sfc /scannow /offbootdir=c:\ /offwindir=c:\windows

Windows Resource Protection could not perform the requested operation.

No Safe Mode with networking.

No Safe Mode with command prompt.

I tried your sfc /scannow… from the command prompt in the System Recovery window.

Startup Repair says: Startup Repair has tried several times but still cannot determine the cause of the problem.

Is this when I start looking for my Windows Boot Disk? :frowning:

Do you have one as we can repair from there - if not I will give you a link to burn the recovery console

Have a disc called system recovery. It boots then takes me to the. Same blasted sys recovery menu. How do I get to safe mode?

Sorry about my typing. Using my hubby’s iPod. They don’t seem to care to make the keys big enough for an adult human finger.

[list]Download and burn the windows recovery environment from here http://www.forum.probz.net/index.php?/files/category/17-windows-recovery-environment-winre/

Then download and run ImgBurn available here http://www.majorgeeks.com/ImgBurn_d4870.html

Once ImgBurn is installed double click the windows re iso and imgburn will open to and start burning it to disc. Even if we do not use this it is handy to keep

Then

I will locate another copy of the file and replace it

OK next we will work outside of windows then Please print these instruction out so that you know what you are doing
[*]Download OTLPENet.exe to your desktop
[*]Ensure that you have a blank CD in the drive
[*]Double click OTLPENet.exe and this will then open imgburn to burn the file to CD
[*]Reboot your system using the boot CD you just created.Note : If you do not know how to set your computer to boot from CD follow the steps here
[*]As the CD needs to detect your hardware and load the operating system, I would recommend a nice cup of tea whilst it loads :slight_smile:
[*]Your system should now display a Reatogo desktop.Note : as you are running from CD it is not exactly speedy [*]Double-click on the OTLPE icon.[*]Select the Windows folder of the infected drive if it asks for a location
[*]When asked “Do you wish to load the remote registry”, select Yes[*]When asked “Do you wish to load remote user profile(s) for scanning”, select Yes
[*]Ensure the box “Automatically Load All Remaining Users” is checked and press OK
[]OTL should now start
[
]in the custom scans box type the following :

/md5start
ntoskrnl.*
/md5stop
[*]Press Run Scan to start the scan.
[*]When finished, the file will be saved in drive C:\OTL.txt
[*]Copy this file to your USB drive if you do not have internet connection on this system
[*]Right click the file and select send to : select the USB drive.
[*]Confirm that it has copied to the USB drive by selecting it
[*]You can backup any files that you wish from this OS
[*]Please post the contents of the C:\OTL.txt file in your reply.

Tried otlpenet. Got blue screen of death. If I try the windows re iso will I lose all my data? I am cloning my hard drive to my external hard drive tonight. Then maybe some reformatting? Got any ideas?

No you will not lose any data with the re disc

Once the disc is running then initially follow the instructions on this page to run a startup repair http://www.bleepingcomputer.com/tutorials/windows-7-recovery-environment-command-prompt/

As you can see there are a lot of options open to you… If the startup repair fails then you will be able to select system restore

Insert the disc into the drive and reboot from the CD - although this states Vista windows 7 is the same…
It is my strongly held conviction that the computer manufacturers should provide this disc with the computer

When you reboot you will see this although yours will say windows 7. Click repair my computer

http://i1224.photobucket.com/albums/ee362/Essexboy3/RepairVista_7275.jpg

Select your operating system

http://i1224.photobucket.com/albums/ee362/Essexboy3/RepairVista_7277202.jpg

Select startup repair

http://i1224.photobucket.com/albums/ee362/Essexboy3/RepairVista_7277.jpg